Methods for revalidating FQDN rulesets in a firewall

Abstract

A method comprises: in response to detecting a new expression in a policy rule, updating a global version number to a new value; identifying a particular IP address that corresponds to an FQDN matching on the new expression; storing an entry comprising the particular IP address, the new expression, and an entry version number in a first data structure, the entry version number being assigned the new value; in response to detecting a new connection to a destination IP address: finding a matching entry in the first data structure corresponding to the destination IP address; determining whether the global version number matches the entry version number for the matching entry; and in response to determining that the global version number does not match the entry version number for the matching entry, sending update information to a slowpath process that associates an updated configuration information for the matching entry.

What is claimed is: 
     
       1. A method for validating a firewall policy rule comprising a source, a destination, and an action, wherein the source or the destination is specified by an expression matching on a fully qualified domain name (FQDN), the expression having a corresponding expression identifier, the method comprising:
 in response to detecting a new expression in a policy rule, updating a global version number to a new value; 
 identifying a particular IP address that corresponds to an FQDN matching on the new expression; 
 storing an entry comprising the particular IP address, the new expression, and an entry version number in a first data structure, the entry version number being assigned the new value; 
 in response to detecting a new connection to a destination IP address:
 finding a matching entry in the first data structure corresponding to the destination IP address; 
 determining whether the global version number matches the entry version number for the matching entry; and 
 in response to determining that the global version number does not match the entry version number for the matching entry, sending update information to a slowpath process that associates an updated configuration information for the matching entry, the update information comprising the destination IP address and an expression of the matching entry to cause the slowpath process to update a second data structure. 
 
 
     
     
       2. The method of  claim 1 , wherein the identifying a particular IP address that corresponds to an FQDN matching on the new expression comprises inspecting DNS response packets using a deep packet inspection approach. 
     
     
       3. The method of  claim 1 , wherein the update information is sent to a slowpath process by communicating a pointer to a descriptor of the update information to the slowpath process. 
     
     
       4. The method of  claim 1 , wherein the detecting a new expression in a policy rule comprises detecting that the policy rule, stored in a firewall policy, has been modified by replacing, in the policy rule, an old expression with the new expression. 
     
     
       5. The method of  claim 1 , wherein the new value of the global version number represents a number of times the policy rule has been updated. 
     
     
       6. The method of  claim 1 , wherein the identifying a particular IP address that corresponds to an FQDN matching on the new expression further comprises:
 identifying, in the second data structure, an expression entry that includes the new expression that matches on the FQDN; 
 determining an expression identifier associated with the expression entry; and 
 storing, in the first data structure, the expression identifier in the entry that also comprises the particular IP address, the new expression, and the entry version number. 
 
     
     
       7. The method of  claim 1 , wherein the policy rule is provided by a management plane or a local management plane. 
     
     
       8. One or more non-transitory computer-readable storage media storing one or more computer instructions which, when executed by one or more processors, cause the one or more processors to perform:
 in response to detecting a new expression in a policy rule, updating a global version number to a new value; 
 identifying a particular IP address that corresponds to an FQDN matching on the new expression; 
 storing an entry comprising the particular IP address, the new expression, and an entry version number in a first data structure, the entry version number being assigned the new value; 
 in response to detecting a new connection to a destination IP address:
 finding a matching entry in the first data structure corresponding to the destination IP address; 
 determining whether the global version number matches the entry version number for the matching entry; and 
 in response to determining that the global version number does not match the entry version number for the matching entry, sending update information to a slowpath process that associates an updated configuration information for the matching entry, the update information comprising the destination IP address and an expression of the matching entry to cause the slowpath process to update a second data structure. 
 
 
     
     
       9. The one or more non-transitory computer-readable storage media of  claim 8 , wherein the identifying a particular IP address that corresponds to an FQDN matching on the new expression comprises inspecting DNS response packets using a deep packet inspection approach. 
     
     
       10. The one or more non-transitory computer-readable storage media of  claim 8 , wherein the update information is sent to a slowpath process by communicating a pointer to a descriptor of the update information to the slowpath process. 
     
     
       11. The one or more non-transitory computer-readable storage media of  claim 8 , wherein the detecting a new expression in a policy rule comprises detecting that the policy rule, stored in a firewall policy, has been modified by replacing, in the policy rule, an old expression with the new expression. 
     
     
       12. The one or more non-transitory computer-readable storage media of  claim 8 , wherein the detecting a new expression in a policy rule comprises detecting that the policy rule is a new rule stored in a firewall policy. 
     
     
       13. The one or more non-transitory computer-readable storage media of  claim 8 , wherein the identifying a particular IP address that corresponds to an FQDN matching on the new expression further comprises:
 identifying, in the second data structure, an expression entry that includes the new expression that matches on the FQDN; 
 determining an expression identifier associated with the expression entry; and 
 storing, in the first data structure, the expression identifier in the entry that also comprises the particular IP address, the new expression, and the entry version number. 
 
     
     
       14. The one or more non-transitory computer-readable storage media of  claim 8 , wherein the policy rule is provided by a management plane or a local management plane. 
     
     
       15. A hypervisor implemented in a host computer and configured to implement a method for revalidating FQDN rulesets in a distributed firewall, the hypervisor comprising:
 one or more processors; 
 one or more memory units; and 
 one or more non-transitory computer-readable storage media storing one or more computer instructions which, when executed by the one or more processors, cause the one or more processors to perform:
 in response to detecting a new expression in a policy rule, updating a global version number to a new value; 
 identifying a particular IP address that corresponds to an FQDN matching on the new expression; 
 storing an entry comprising the particular IP address, the new expression, and an entry version number in a first data structure, the entry version number being assigned the new value; 
 in response to detecting a new connection to a destination IP address:
 finding a matching entry in the first data structure corresponding to the destination IP address; 
 determining whether the global version number matches the entry version number for the matching entry; and 
 in response to determining that the global version number does not match the entry version number for the matching entry, sending update information to a slowpath process that associates an updated configuration information for the matching entry, the update information comprising the destination IP address and an expression of the matching entry to cause the slowpath process to update a second data structure. 
 
 
 
     
     
       16. The hypervisor of  claim 15 , wherein the identifying a particular IP address that corresponds to an FQDN matching on the new expression comprises inspecting DNS response packets using a deep packet inspection approach. 
     
     
       17. The hypervisor of  claim 15 , wherein the update information is sent to a slowpath process by communicating a pointer to a descriptor of the update information to the slowpath process. 
     
     
       18. The hypervisor of  claim 15 , wherein the detecting a new expression in a policy rule comprises detecting that the policy rule, stored in a firewall policy, has been modified by replacing, in the policy rule, an old expression with the new expression. 
     
     
       19. The hypervisor of  claim 15 , wherein the detecting a new expression in a policy rule comprises detecting that the policy rule is a new rule stored in a firewall policy. 
     
     
       20. The hypervisor of  claim 15 , wherein the identifying a particular IP address that corresponds to an FQDN matching on the new expression further comprises:
 identifying, in the second data structure, an expression entry that includes the new expression that matches on the FQDN; 
 determining an expression identifier associated with the expression entry; and 
 storing, in the first data structure, the expression identifier in the entry that also comprises the particular IP address, the new expression, and the entry version number.